This policy explains which personal data EXL Trade processes, why, who we share it with and how you can exercise your rights. It applies to the website, the dashboard, the checkout, the Help Center, the Partners Program and support.
1. Who processes your data
1.1. The controller is EXL TRADE CAPITAL LTDA, Brazilian company registration (CNPJ) 57.172.434/0001-96, Campinas, São Paulo, Brazil.
1.2. Privacy channel: privacidade@exltrade.com. Use this channel for any request about your data, including if you live outside Brazil.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Registration | name, e-mail, phone, country, language, national ID (CPF in Brazil), address | you |
| Identity verification | photo ID, a selfie holding the document, proof of address, proof of ownership of the receiving account | you; BigDataCorp (CPF check and document analysis) |
| Payment | amount, currency, payment method, transaction ID, last card digits | you; Stripe, Mercado Pago, Pagar.me |
| Trading | accounts, orders, trades, results, times and IP addresses used on the platform | Nelogica; EXL systems |
| Payouts | receiving account details (Pix or Rise), amounts and receipts | you; Rise |
| Website use | pages visited, device, browser, IP address, cookies | your browser |
| Support | messages by e-mail and WhatsApp | you |
| Partners and referrals | code of the partner who referred you, coupon, referral click | cookies and links |
| Waitlist | email, name (optional), language, country, source and campaign parameters (UTM), plan of interest, date, IP address and browser at the time of consent | you; your browser |
The selfie is a photo of you holding the document and is reviewed by a person at EXL. We do not use automated facial recognition.
3. Why we use it and on what legal basis
| Purpose | Legal basis (LGPD; GDPR) |
|---|---|
| Creating your registration, releasing and running accounts, evaluating, paying out, providing support | performance of a contract (art. 7, V; art. 6(1)(b)) |
| Meeting tax, accounting and record-keeping obligations | legal obligation (art. 7, II; art. 6(1)(c)) |
| Preventing fraud, verifying identity and detecting prohibited conduct, including comparing IP addresses and order patterns across accounts | legitimate interest (art. 7, IX; art. 6(1)(f)); for the selfie and the ID document, fraud prevention when identifying registrations (art. 11, II, "g") |
| Defending rights in legal proceedings and payment disputes | exercise of rights (art. 7, VI; art. 6(1)(f)) |
| Measuring website use and improving the service | legitimate interest |
| Attributing the sale to the partner who referred you | legitimate interest in Brazil, Latin America and other countries, with the option to refuse (refusing deletes the _cref cookie); consent in the European Union, the European Economic Area and the United Kingdom |
| Sending offers and news | consent, which you can withdraw at any time |
| Notifying people on the waitlist when EXL Career launches | consent (art. 7, I; art. 6(1)(a)), which you can withdraw at any time |
4. Automated decisions
The evaluation assessment and payout checks are calculated by the system from the rules in your Rules Sheet. A person at EXL checks and decides. You can ask for a review of any decision through support or the privacy channel (LGPD, art. 20).
5. Who we share it with
Only what each purpose requires:
- Nelogica: trading platform, licenses and trading data;
- Stripe, Mercado Pago and Pagar.me: payments;
- Rise: payouts to residents outside Brazil;
- BigDataCorp: CPF validation and identity-document analysis for Brazilian registrations;
- Supabase, Vercel and Hostinger: database, login, website and servers;
- Resend: e-mail delivery;
- Google: sign-in with Google, when you choose it;
- Sentry: technical error logs;
- Cloudflare Turnstile: bot protection at registration and on the waitlist;
- WhatsApp (Meta): when you contact us there;
- Meta Platforms (Facebook and Instagram): measurement of our ads through the Meta Pixel (on the website) and the Conversions API (registrations and approved purchases);
- OpenPartner: the Partners Program system, installed on an EXL server;
- the partner who referred you: only your abbreviated name;
- authorities: when the law or a court order requires it.
We do not sell personal data.
6. International transfers
Some providers are outside Brazil, mainly in the United States. For these transfers we use the safeguards provided for in article 33 of the LGPD and, for residents of the European Economic Area and the United Kingdom, the GDPR safeguards.
7. How long we keep it
| Data | Period |
|---|---|
| Contract, acceptance, assessments, passes, failures and payouts | 5 years after the relationship ends |
| Access logs | at least 6 months |
| Marketing data | until you withdraw consent |
| EXL Career waitlist | 12 months after the launch notice, or earlier if you ask |
| Other data | while needed for the purpose, then deleted or anonymized |
8. Your rights
You can ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; information on who we share it with; deletion of data processed on the basis of consent; withdrawal of consent; review of automated decisions; and objection to processing based on legitimate interest (LGPD, arts. 18 and 20; GDPR, arts. 15 to 22).
Write to privacidade@exltrade.com. We reply within 15 days. We may ask you to confirm your identity first. Some data is kept when the law requires it (section 7). You can also complain to the ANPD or to the data protection authority of your country.
9. Security and incidents
We use access control, encryption in transit and audit logs. If an incident may cause significant risk or harm, we notify the ANPD and the people affected within 3 business days (ANPD Resolution 15/2024).
10. Minors
We do not serve people under 18. If we identify a minor's registration, it is closed.
11. Cookies
Cookies are small files the website stores in your browser. On your first visit, the banner lets you accept, reject or choose by category. You can change your choice at any time through the "Cookies" link in the footer.
| Category | Purpose | Consent required? |
|---|---|---|
| Essential | login, security, payment and your cookie choice | no |
| Preferences | language and the dashboard side menu | no |
| Measurement | counting visits and understanding how the website is used | yes |
| Partner attribution | knowing which partner referred you | in Brazil, Latin America and other countries, no (legitimate interest, with the option to refuse); in the EU, the EEA and the UK, yes |
| Ads (Meta) | measuring our ads on Facebook and Instagram (Meta Pixel) | no |
| Cookie | Category | Duration | Purpose |
|---|---|---|---|
exl_privacy_consent | essential | 180 days | stores your cookie choice |
exl_country | essential | 30 days | stores the country you visit from, to choose the display language and currency |
Supabase session (sb-…) | essential | up to 400 days, renewed while you use the account; deleted when you sign out | keeps you signed in |
NEXT_LOCALE | preference | session (deleted when you close the browser) | remembers your language |
sidebar:state | preference | 7 days | remembers whether the dashboard side menu is open |
_exl_inv, _exl_inv_done | functional | 30 days | stores an invitation from another trader |
_cref, _cref_identified | partner attribution | 30 days | stores the click on a partner link |
_fbp, _fbc | ads (Meta) | 90 days | identify the browser and the ad click so Meta can measure our ads |
| Vercel Analytics | measurement | no cookie; identifier of up to 24 hours | counts visits in aggregate, only after you accept measurement |
| Stripe, Mercado Pago, Cloudflare Turnstile | essential (anti-fraud) | set by those services | protect payment and registration |
Refusing partner attribution deletes _cref and prevents the referral from being linked to your profile. The partner's coupon still works, because it does not depend on cookies.
12. Changes to this policy
We announce material changes by e-mail or in the dashboard before they take effect. The current version is always at exltrade.com/privacidade.